Perimeter
6/30/2011
04:52 PM
Commentary
Commentary
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Mass-Meshing A Gumblar Creation

Who doesn't love a new buzzword? 'Mass-meshing' is a new term that describes an old problem first presented by the Gumblar attacks in 2009

Recent media reports point to a supposed new type of attack that has been dubbed "mass-meshing" by the folks over at Amortize.

The Amortize report states, “We want to report a new type of mass-scale drive-by download attack that we'll dub "Mass Meshing Injection."" The report then goes on to explain what it is and how it differs from a SQL injection attack. The crux of their concern is that in this “new type” of attack, “Every redirector is itself an infected domain, which means blacklisting becomes more difficult and prune to false alerts.”

But that was exactly the case two years ago with Gumblar. From our ScanSafe blog post then:

“In a typical outbreak situation, there are compromised websites that act as a conduit for malware hosted on an attacker owned site. But in this case, the malware resides on thousands of legitimate (but compromised) websites.”

Of course, all those Gumblar-backdoored websites proved fertile grounds for other attackers to abuse, and in October 2009 we saw Zeus adapting this same method:

“Interestingly, compromised pages are also being injected with external source references to the malware contained on other compromised sites. Those who followed last week's report of the newest Gumblar technique will recall that unlike traditional compromises which simply inject pointers to malware hosted on an attacker-owned domain, in these attacks the compromised domain is also acting as host for the malware itself."

At the time, we also noted that:

"This method of attack complicates remediation via technologies that rely on blacklisting because the number of compromised websites (now acting as malware hosts) is in the thousands.”

And we also reported the same method being used in a random malvertising attack in 2010:

“ScanSafe STAT has been investigating an ongoing series of attacks which has been a hotbed for zero day exploits over the first quarter of 2010. The attackers are using three layers of legitimate sites. Two layers are compromised websites used to host malicious content that is then subsequently pushed to a third layer of legitimate websites via syndicated ads.”

The above references aren't to minimize the severity of mass-meshing style attacks, but rather just to point out that the mass-meshing technique isn't new.

Indeed, today it is pretty common to see interwoven attacks in which the compromised sites work in concert to interchangeably serve as conduit, redirector, and/or the actual malware host.

And while it does pose some additional challenges, overall security vendors seem to be coping fairly well with it. (Though obviously anyone relying purely on blacklisting would have a problem, but most use more layered defenses).

I have to say though that while the attack method isn't new, mass-meshing is a pretty cool, new buzzword to describe it.

Mary Landesman is an antivirus professional and senior security researcher for ScanSafe, now part of Cisco. In 2009 she was awarded a Microsoft MVP for her work in consumer security.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web